username validation -- only allow letters and digits